fix(cic): address gray-check PR review - official build, step-level gate, note sync

Address ds-review-bot findings on PR #2798:

- release-publish.yml: use pnpm run build:official (not build) so the dsh
  pack step's verifyBuildArtifacts (families.ts:327, readClientBuildRecord with
  officialClientBuildEnvironment) finds the official client-build record; build
  would fail Pack release tarballs on a clean runner.
- issue-lifecycle.yml: move the previous job-level if to step level on
  Create project token and Handle repository event, so approved/commented
  reviews pass (job reported success, no gray segment) without minting a
  write-capable App token or touching the board — preserving the original
  least-privilege property.
- ci-workflow.spec.ts: lock the step-level gate on the two lifecycle steps, and
  add a release-workflow invariant test (release.yml/vendor are pack-only;
  release-publish.yml/vendor-publish.yml are workflow_dispatch-only with the
  npm-publish environment and Release-publish group) to prevent #2797 recurrence.
- Update 2026-08-10-event-directed-pr-review-status and 2026-08-10-npm-release-
  sequences notes (en/zh/i18n) to the new split and step-level behavior.

Verification: ci-workflow.spec.ts 14/14, typecheck clean, all five workflows
YAML-parse, verify-translation-pairing consistent, note-format 582.

.github/workflows/issue-lifecycle.yml

@@ -36,10 +36,11 @@ concurrency:
 jobs:
   lifecycle:
     name: Issue lifecycle
-    # Run on every pull_request_review event, not only changes_requested, so the
-    # check shows a passing result instead of a gray "skipped" segment. The
-    # lifecycle handler itself no-ops (returns success) for approved/commented
-    # reviews; only a changes_requested review drives the Project board.
+    # Runs on every pull_request_review event so the check reports success rather
+    # than a gray "skipped" segment. The token-creating and board-mutating steps
+    # are gated at step level (a skipped step does not gray the job): only a
+    # changes_requested review drives the Project board; approved/commented
+    # reviews never mint a write-capable App token.
     runs-on: ubuntu-latest
     steps:
       - name: Check out trusted policy
@@ -49,6 +50,7 @@ jobs:
           persist-credentials: false
       - name: Create project token
         id: app-token
+        if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'changes_requested' }}
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
         with:
           client-id: ${{ vars.DSH_ISSUE_APP_CLIENT_ID }}
@@ -56,6 +58,7 @@ jobs:
           owner: deepseek-harness
           repositories: deepseek-harness
       - name: Handle repository event
+        if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'changes_requested' }}
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: node .github/issue-management/policy.mjs lifecycle

.github/workflows/release-publish.yml

@@ -58,7 +58,7 @@ jobs:
         run: pnpm run release:verify --family dsh
 
       - name: Build
-        run: pnpm run build
+        run: pnpm run build:official
 
       - name: Pack release tarballs
         run: pnpm run release:pack --family dsh --out dist/npm